Advisories · Technology

Node.

Every CVE that names Node among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-36138 CVE record

CVSS 8.1 High

Command injection in Node
- Node
- Command injection
Not analysed yet 7 Sept 2024
CVE-2023-39333 CVE record

CVSS 5.3 Medium

Code injection in Node
- Node
- Code injection
Not analysed yet 7 Sept 2024
CVE-2024-36137 CVE record

CVSS 3.3 Low

Node: A vulnerability has been identified in Node.js…
- Node
Not analysed yet 7 Sept 2024
CVE-2023-30582 CVE record

CVSS 5.3 Medium

Improper access control in Node
- Node
- Broken access control
Not analysed yet 7 Sept 2024
CVE-2023-30587 CVE record

CVSS 7.5 High

Improper access control in Node
- Node
- Broken access control
Not analysed yet 7 Sept 2024
CVE-2023-30583 CVE record

CVSS 7.5 High

Improper access control in Node
- Node
- Broken access control
Not analysed yet 7 Sept 2024
CVE-2023-30584 CVE record

CVSS 7.7 High

Path traversal in Node
- Node
- Path traversal
Not analysed yet 7 Sept 2024
CVE-2024-22018 CVE record

CVSS 2.9 Low

Node: A vulnerability has been identified in Node.js…
- Node
Not analysed yet 10 Jul 2024
CVE-2024-22020 CVE record

CVSS 6.5 Medium

Code injection in Node
- Node
- Code injection
Not analysed yet 9 Jul 2024
CVE-2024-27982 CVE record

CVSS 6.5 Medium

HTTP request smuggling in Node
- Node
- HTTP request smuggling
Not analysed yet 7 May 2024
CVE-2024-27983 CVE record

CVSS 8.2 HighCritical · CVSS 7+ and EPSS

Race condition in Node
- Node
- Race condition
Not analysed yet 9 Apr 2024
CVE-2024-22025 CVE record

CVSS 6.5 Medium

Improper resource shutdown in Node
- Node
- Denial of service
Not analysed yet 19 Mar 2024
CVE-2024-22017 CVE record

CVSS 7.3 High

Execution with unnecessary privileges in Node
- Node
- Privilege escalation
Not analysed yet 19 Mar 2024
CVE-2024-21896 CVE record

CVSS 7.9 High

Node: The permission model protects itself against path traversal attacks by calling…
- Node
- CWE-27
Not analysed yet 20 Feb 2024
CVE-2024-21890 CVE record

CVSS 5.0 Medium

Node: The Node.js Permission Model does not clarify in the documentation that wildcards should…
- Node
Not analysed yet 20 Feb 2024
CVE-2024-21891 CVE record

CVSS 7.9 High

Path traversal in Node
- Node
- Path traversal
Not analysed yet 20 Feb 2024
CVE-2024-22019 CVE record

CVSS 7.5 High

Improper resource shutdown in Node
- Node
- Denial of service
Not analysed yet 20 Feb 2024
CVE-2024-21892 CVE record

CVSS 7.5 High

Improper privilege management in Node
- Node
- Privilege escalation
Not analysed yet 20 Feb 2024
CVE-2023-30590 CVE record

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the functi…
- Node
Not analysed yet 28 Nov 2023
CVE-2023-30588 CVE record

Node: When an invalid public key is used to create an x509 certificate using the…
- Node
Not analysed yet 28 Nov 2023
CVE-2023-30585 CVE record

Node: A vulnerability has been identified in the Node.js (.msi version) installation process…
- Node
Not analysed yet 28 Nov 2023
CVE-2023-30581 CVE record

CVSS 7.5 High

Missing authorization in Node
- Node
- Broken access control
Not analysed yet 22 Nov 2023
CVE-2023-39331 CVE record

CVSS 7.7 High

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6.
- Node
Not analysed yet 18 Oct 2023
CVE-2023-38552 CVE record

Node: When the Node.js policy feature checks the integrity of a resource against a trusted…
- Node
Not analysed yet 18 Oct 2023
CVE-2023-39332 CVE record

Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects.
- Node
Not analysed yet 18 Oct 2023
CVE-2023-32558 CVE record

Node: The use of the deprecated API `process.binding()` can bypass the permission model through…
- Node
Not analysed yet 12 Sept 2023
CVE-2023-32005 CVE record

CVSS 5.3 Medium

Incorrect permission assignment in Node
- Node
- Broken access control
Not analysed yet 12 Sept 2023
CVE-2023-32559 CVE record

CVSS 7.5 High

Improper privilege management in Node
- Node
- Privilege escalation
Not analysed yet 24 Aug 2023
CVE-2023-32002 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Authentication bypass in Node
- Node
- Authentication bypass
Not analysed yet 21 Aug 2023
CVE-2023-32003 CVE record

CVSS 5.3 Medium

Path traversal in Node
- Node
- Path traversal
Not analysed yet 15 Aug 2023
CVE-2023-32004 CVE record

CVSS 8.8 High

Path traversal in Node
- Node
- Path traversal
Not analysed yet 15 Aug 2023
CVE-2023-32006 CVE record

CVSS 8.8 High

Protection mechanism failure in Node
- Node
- CWE-693
Not analysed yet 15 Aug 2023
CVE-2023-30586 CVE record

CVSS 7.5 High

Missing authorization in Node
- Node
- Broken access control
Not analysed yet 30 Jun 2023
CVE-2023-23920 CVE record

CVSS 4.2 Medium

Untrusted search path in Node
- Node
- CWE-426
Not analysed yet 23 Feb 2023
CVE-2023-23919 CVE record

CVSS 7.5 High

Node: A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1…
- Node
- CWE-310
Not analysed yet 23 Feb 2023
CVE-2023-23918 CVE record

CVSS 7.5 High

Incorrect authorization in Node
- Node
- Broken access control
Not analysed yet 23 Feb 2023
CVE-2022-43548 CVE record

CVSS 8.1 HighCritical · CVSS 7+ and EPSS

OS command injection in Node
- Node
- Command injection
Not analysed yet 5 Dec 2022
CVE-2022-35256 CVE record

CVSS 6.5 Medium

HTTP request smuggling in Node
- Node
- HTTP request smuggling
Not analysed yet 5 Dec 2022
CVE-2022-35255 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Weak random number generator in Node
- Node
- Weak cryptography or TLS
Not analysed yet 5 Dec 2022
CVE-2022-32223 CVE record

Uncontrolled search path in Node
- Node
- CWE-427
Not analysed yet 14 Jul 2022
CVE-2022-32222 CVE record

Node: A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to…
- Node
- CWE-310
Not analysed yet 14 Jul 2022
CVE-2022-32215 CVE record

HTTP request smuggling in Node
- Node
- HTTP request smuggling
Not analysed yet 14 Jul 2022
CVE-2022-32212 CVE record

Improper access control in Node
- Node
- Broken access control
Not analysed yet 14 Jul 2022
CVE-2021-44533 CVE record

Improper certificate validation in Node
- Node
- Weak cryptography or TLS
Not analysed yet 24 Feb 2022
CVE-2021-44532 CVE record

Node: Node.js < 12.22.9, < 14.18.3, < 16.13.2…
- Node
- CWE-296
Not analysed yet 24 Feb 2022
CVE-2021-44531 CVE record

Improper certificate validation in Node
- Node
- Weak cryptography or TLS
Not analysed yet 24 Feb 2022
CVE-2022-21824 CVE record

Node: Due to the formatting logic of the "console.table()" function it was not safe to allow…
- Node
- CWE-471
Not analysed yet 24 Feb 2022
CVE-2021-22959 CVE record

HTTP request smuggling in Node
- Node
- HTTP request smuggling
Not analysed yet 15 Nov 2021
CVE-2021-22960 CVE record

HTTP request smuggling in Node
- Node
- HTTP request smuggling
Not analysed yet 3 Nov 2021
CVE-2021-22930 CVE record

Use after free in Node
- Node
- Memory corruption
Not analysed yet 7 Oct 2021
CVE-2021-22940 CVE record

Use after free in Node
- Node
- Memory corruption
Not analysed yet 16 Aug 2021
CVE-2021-22939 CVE record

Improper certificate validation in Node
- Node
- Weak cryptography or TLS
Not analysed yet 16 Aug 2021
CVE-2021-22931 CVE record

Improper null termination in Node
- Node
- CWE-170
Not analysed yet 16 Aug 2021
CVE-2021-22921 CVE record

Incorrect permission assignment in Node
- Node
- Broken access control
Not analysed yet 12 Jul 2021
CVE-2021-22918 CVE record

Out-of-bounds read in Node
- Node
- Memory corruption
Not analysed yet 12 Jul 2021
CVE-2021-22883 CVE record

Uncontrolled resource consumption in Node
- Node
- Denial of service
Not analysed yet 3 Mar 2021
CVE-2021-22884 CVE record

Node: Node.js before 10.24.0, 12.21.0, 14.16.0…
- Node
- CWE-350
Not analysed yet 3 Mar 2021
CVE-2020-8265 CVE record

Use after free in Node
- Node
- Memory corruption
Not analysed yet 6 Jan 2021
CVE-2020-8287 CVE record

HTTP request smuggling in Node
- Node
- HTTP request smuggling
Not analysed yet 6 Jan 2021
CVE-2020-8277 CVE record

Uncontrolled resource consumption in Node
- Node
- Denial of service
Not analysed yet 19 Nov 2020